Information Security Basics
A company with thousands of employees manages permissions with role-based access control (RBAC). Which statement describes the idea of RBAC?
- AThe owner of each file freely decides who may read or write that file
- BPermissions are defined in bundles for each role, such as "accounting" or "human resources," and users are assigned roles
- CPermissions are set one by one for every combination of user and file
Show answer and explanation
Answer: B. Permissions are defined in bundles for each role, such as "accounting" or "human resources," and users are assigned roles
In role-based access control (RBAC), the permissions needed for each job role are defined together in advance, and users are assigned roles. Users can use only the permissions of their assigned roles. When someone transfers, simply changing their role assignment switches all their permissions correctly at once. Setting permissions for each user-file combination becomes unmanageable as people and files increase, and unneeded permissions are easily left behind. A scheme in which file owners freely decide permissions is called discretionary access control (DAC); it is used for file permissions in many operating systems, but it makes it hard to keep organization-wide policy consistent.
- A. A scheme in which owners decide freely is discretionary access control (DAC), not RBAC.
- B. Correct. Permissions are bundled by role, and users are assigned roles.
- C. Setting permissions per user-file combination becomes unmanageable at scale. RBAC is the way to group them by role.